Bitdefender discovers new group of cybercriminals attacking critical infrastructure near Romania's borders

  A new active group of cybercriminals supporting the interests of the Russian Federation is involved in attacks on critical infrastructure across the broader Black Sea region, with confirmed targets including judicial and governmental institutions in Georgia, as well as an electricity provider in the Republic of Moldova, Bitdefender cybersecurity experts report.In a press release sent on Tuesday, the experts emphasized that the methods used by the group known as Curly COMrades include prolonged network access, data theft, and masking traffic through legitimate websites ? techniques that could also be replicated against Romanian organizations, including those in sectors such as energy, transport, and public administration."The investigation revealed the use of advanced persistence techniques, redundant access infrastructures, and a new type of attack tool, MucorAgent. This tool employs an unprecedented persistence method in the company's research, exploiting a standard Windows component to reactivate unpredictably and stealthily. Attacks observed in neighboring or geographically close states indicate potential threats that may target Romania. Physical borders no longer limit cyber risks, and geographic proximity, economic ties, and interconnected infrastructures make continuous monitoring and rapid response capabilities essential for Romanian companies and institutions," the release reads.In this context, Bitdefender specialists recommend continuous monitoring of unusual network activity and blocking traffic to suspicious external servers, along with restricting the use of remote administration tools unless strictly necessary.Furthermore, the implementation of incident detection and response solutions such as EDR (Endpoint Detection and Response) and XDR (Extended Detection and Response) is needed. These solutions monitor network and internal system activity in real time, identify suspicious behaviors, and allow quick reactions ? especially important for organizations without dedicated internal security teams.Additionally, another recommendation is to use MDR (Managed Detection and Response) services, which provide specialized external teams offering 24/7 monitoring, investigation, and attack response."Attacks observed in neighboring or geographically close states represent a possible indicator of threats that could target Romania. Physical borders no longer limit cyber risks, and geographic proximity, economic links, and interconnected infrastructures require continuous monitoring and rapid response from Romanian companies and institutions," experts stressed.Bitdefender offers advanced solutions for prevention, detection, and response to cybersecurity incidents. The company's laboratories discover hundreds of new cyber threats every minute and validate 50 billion daily threat queries. Bitdefender's technologies are licensed to over 200 of the world's best-known security brands.